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A top priority of any launch vehicle is to insert as much mass into the desired orbit as 
possible. This requirement must be traded against vehicle capability in terms of dynamic 
control, thermal constraints, and structural margins. The vehicle is certified to specific 
structural limits which will yield certain performance characteristics of mass to orbit. Some 
limits cannot be certified generically and must be checked with each mission design. The 
most sensitive limits require an assessment on the day-of-launch. To further minimize 
vehicle loads while maximizing vehicle performance, a day-of-launch trajectory can be 
designed. This design is optimized according to that day’s wind and atmospheric conditions, 
which increase the probability of launch. The day-of-launch trajectory design and 
verification process is critical to the vehicle’s safety. 


The Day-Of-Launch I-Load Update (DOLILU) is the process by which the National 
Aeronautics and Space Administration’s (NASA) Space Shuttle Program tailors the vehicle 
steering commands to lit that day’s environmental conditions and then rigorously verifies 
the integrated vehicle trajectory’s loads, controls, and performance. This process has been 
successfully used for almost twenty years and shares many of the same elements with other 
launch vehicles that execute a day-of-launch trajectory design or day-of-launch trajectory 
verification. Weather balloon data is gathered at the launch site and transmitted to the 
Johnson Space Center’s Mission Control. The vehicle’s first stage trajectory is then 
adjusted to the measured wind and atmosphere data. The resultant trajectory must satisfy 
loads and controls constraints. Additionally, these assessments statistically protect for non- 
observed dispersions. One such dispersion is the change in the wind from the last measured 
balloon to launch time. This process is started in the hours before launch and is repeated 
several times as the launch count proceeds. Should the trajectory design not meet all 
constraint criteria, Shuttle would be No-Go for launch. 


This Shuttle methodology is very similar to other unmanned launch vehicles. By 
extension, this method would likely be employed for any future NASA launch vehicle. This 
paper will review the Shuttle’s day-of-launch trajectory optimization and verification 
operations as an example of a more generic application of day-of-launch design and 
validation. With Shuttle’s retirement, it is fitting to document the current state of this 
critical process and capture lessons learned to benefit current and future launch vehicle 
endeavors. 
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A top priority of any launch vehicle is to safely and reliably insert as much mass into the 
desired orbit as possible. Some structural constraints cannot be certified generically and 
must be checked with each mission design. The most sensitive constraints require an 
assessment on the day-of-launch. To further minimize vehicle structural loading while 
maximizing vehicle performance, a day-of-launch trajectory must be designed. The Day-Of- 
Launch I-Load Update (DOLILU) is the process by which the National Aeronautics and 
Space Administration’s (NASA) Space Shuttle Program tailors the vehicle steering 
commands to lit that day’s environmental conditions and then rigorously verifies the 
integrated vehicle trajectory’s loads, controls, and performance. This process has been 
successfully used for almost twenty years and shares many of the same elements with other 
launch vehicles. This paper will review the current state of the Shuttle’s day-of-launch 
trajectory optimization and verification operations to benefit current and future launch 
vehicle endeavors. 


I. Introduction 

W/ ITH the final Space Shuttle launch on July 8th, 2011, the National Aeronautics Space Administration (NASA) 
" v saw the final execution of a just-in-time trajectory design and validation process. The trajectory was not 
planned months or even days before launch, but rather was tailored to the specific atmospheric conditions of the day. 
The Space Shuttle successfully experienced vehicle structural loading well within capability. The duty to center the 
vehicle structural constraints while optimizing mission success is completed by a robust trajectory design and 
verification system. Sixty-six consecutive shuttle launches have successfully utilized the same methodology. Most 
space vehicles must design their trajectory to the atmospheric conditions of the day in order to recenter vehicle loads 
and maximize launch opportunities. The Space Shuttle has used the Day-of-Launch Initialization Load Update, or 
DOLILU, system for this safety critical trajectory design and verification task. 
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II. Process Overview 


The Space Shuttle guidance is broken into two stages: the first, from liftoff to Solid Rocket Booster (SRB) 
separation and the second, from staging to main engine cutoff (MECO). The first stage guidance is open-loop, while 
the second stage is closed-loop. The first stage is flying specific steering commands developed by ground software 
to meet specific staging criteria and minimize sensed loads. The second stage closed-loop guidance cyclically 
computes the thrust vector required to execute a fuel-optimal trajectory to a specific MECO target that is defined by 
a specific terminal velocity, inertial flight path angle, altitude, and desired orbital plane. The MECO target is not 
constrained in the downrange direction. 

First stage flight includes a region from near sea level to an altitude of approximately 155,000 feet (ft) and 
subjects the vehicle to atmospheric conditions of the day. The vehicle will experience the highest dynamic pressure 
(Qbar) near 35,000 ft. Launch day wind speed and related atmospheric conditions will have an impact on the sensed 
loading which will tend to pull the trajectory away from the desired staging targets. Launch day loads and 
performance variations can be significant. A check of constraints and performance is required to verify that the 
projected flight conditions are within vehicle certification limits. Vehicle first stage steering commands and Space 
Shuttle Main Engines (SSME) throttle commands are updated on launch day to make the trajectory more compatible 
with atmospheric conditions and to rebalance the vehicle’s first stage trajectory. This approach tends to reduce 
loads without a large impact to vehicle performance capability. 

The DOLILU design process is accomplished using ground software and personnel skilled in the design and 
verification of the trajectory. Hours before lift-off, weather balloons are released near the launch site to measure the 
wind and other atmospheric conditions. Balloon data is relayed to engineers at the Johnson Space Center (JSC) to 
be used as in input to an iterative computer simulation program which is used to design the first stage guidance 
parameters or initialization loads (I-Load). A second higher fidelity six degree-of- freedom (6-DOF) computer 
simulation is used to validate the updates steering and throttle tables. The resulting trajectory prediction is assessed 
to verify that all trajectory, control, systems, structural loading, and performance constraints are met. An 
independent assessment of the 1-loads is required prior to launch. About two hours before lift-off, the design is 
frozen and I-loads are uplinked to the Space Shuttle. Additional constraint verification assessments are completed 
using wind measurements made closer to launch. If the final constraint assessment results in a predicted constraint 
violation, then the launch is scrubbed and rescheduled. 


III. Team 

The console position that reports a DOLILU No-go is the Loads and DOLILU Officer (LDO). This position has 
the primary responsibility of the DOLILU system for a given launch. This person reports to the NASA Flight 
Director, Systems Integration representatives, and to the Mission Operations Directorate (MOD) representative on 
the NASA Mission Management Team (MMT). Reporting to the LDO are the Prime Team at JSC, the Independent 
Verification and Validation (IV&V) Team, and natural environments experts at Marshall Space Flight Center 
(MSFC). These teams consist of subject matter experts in the fields of trajectory design, vehicle structural loadings, 
and vehicle performance. 

The Prime Team is responsible for the trajectory design, verification, and integration of the total DOLILU 
system. This team operates in the Mission Control Center (MCC) at JSC. The IV&V Team is responsible for the 
independent verification of the trajectory and pre-launch trajectory certification. The IV&V Team is located at a 
contractor remote location. The MSFC Environments Team is responsible for wind-only DOLILU constraints and 
providing pre-launch environmental expertise. 
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Figure 1: General Flow of DOLILU 


IV. Balloon Systems 

The Space Shuttle DOLILU system requires wind speed, wind direction, and atmospheric thermodynamic data 
measured on the day-of-launch (DOL). This data is provided by 45th Space Wing functions at the Cape Canaveral 
Air Force Base (Cape), releasing weather balloons about ten miles south of the Space Shuttle launch pads. Cape 
personnel utilize various weather balloons and other instruments to obtain high fidelity data for Space Shuttle 
trajectory simulation use 1 . 


The Radar tracked Jimsphere balloon is the baseline system to obtain high fidelity wind 
speed and direction up to about 58,000 ft. This weather balloon is a two meter Radar 
reflective sphere with 396 cones on the surface to stabilize the balloon during ascent. This 
balloon is tracked by one to two Radars near the Cape. The balloon takes about 65 minutes to 
rise to altitude with wind data reported in 100 ft intervals. Pressure relief valves on the 
balloon allow it to equalize pressure and maintain a constant volume and therefore a constant 
rise rate of about 1000 feet per second. 


The Automated Meteorological Profiling System 
(AMPS) High-Resolution balloon system measures wind 
speed and direction up to about 56,000 ft. Meant to 
replace the aging Jimsphere system, it is similar in most 
aspects. This balloon is not Radar tracked, rather, it has 
a small Global Positioning System (GPS) enabled flight 
element to obtain wind components. The additional 
weight of the flight element is responsible for the slight 
decrease in average altitude. 

The AMPS Low-Resolution balloon system is used to 
Figure 3. Jimsphere Balloon measure thermodynamic data as well as wind data. 




Figure 2. 
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Temperature, humidity, density, wind speed, and wind direction are reported for Space Shuttle use at 1000 ft 
intervals. This balloon system utilizes a two meter latex balloon with a GPS enabled flight element hanging 70 ft 
below. The Low-Resolution balloon system rises to about 100,000 ft in about 100 minutes. 

The 50 MHz Doppler Radar Wind Profiler (DRWP) is a ground Radar placed on a five acre octagon shaped field 
located near the launch site. Wind data is derived using Radar reflections from background particulates in the 
atmosphere and is measured in 476 ft (145 meter) intervals from 8,700 ft to 61,000 ft (2.67 to 18.6 kilometers). The 
entire wind profile is measured every five minutes. Supplementary, 9.15 MHz Doppler Radar Wind Profilers can be 
utilized to measure the wind every fifteen minutes from the surface to about 6,500 ft. 

The Space Shuttle DOL1LU team utilizes a forecasted wind from the surface to 80,000 ft for wind-only 
evaluations. This upper level wind point forecast is created by meteorologists at JSC. Originally used for Space 
Shuttle entry simulation evaluations, DOL1LU developed use for this wind in qualitative and quantitative real-time 
analysis on DOL. The forecast wind is primarily used to anticipate large changes in the wind throughout the 
countdown. 


V. Balloon Acceptance 

Cape personnel QA the balloon profile based on current atmospheric conditions and other atmosphere sources 
ensuring Space Shuttle requirements are met. Wind data is required for DOL1LU evaluation from 1,500 ft to where 
the vehicle reaches mach 2.2 (on average this is 58,000 ft). The lower requirement of 1,500 ft is near the beginning 
of the Space Shuttle single axis rotation (SAR) or roll maneuver. The upper requirement of mach 2.2 corresponds to 
the upper limit of the structural loads and vehicle certification constraints. With the upper requirement in terms of 
mach, the altitude which corresponds to mach 2.2 varies, and is seasonally dependent. Mach 2.2 is higher in low 
performing months such as February and lower in better performing months such as October. 

While the DOL1LU normally only uses the Low-Resolution balloons for thermodynamic data, wind data from 
this balloon system can also be utilized for specific contingencies. Should neither the Jimsphere nor the High- 
Resolution balloon reach mach 2.2, wind data from the Low-Resolution can be assessed. 

Erroneous data points are removed by the Cape from the wind profiles and replaced with interpolated data. 
Should the Cape remove more than three consecutive data points, the profile is not acceptable for Space Shuttle 
evaluation. Vehicle structural load calculations are sensitive to small changes in the wind. As a result, use of data 
with greater than 400 ft interpolations can result in a false Go indication. 


VI. Balloon Reliability 

Not all weather balloon data is useable due to hardware, software, and operational errors. While the Radar 
tracking of the Jimsphere balloons topped the list of balloon problems, Jimsphere balloons are still preferred over 
High-Resolution balloons by the Space Shuttle Program. This preference is based on a higher termination altitude 
and less interpolated edits in the profile. To increase the likelihood of receiving a good profile, both balloon systems 
are used. 

For most circumstances, a single Jimsphere balloon is tracked by two Radars. These two data streams are the 
prime and first backup sources for wind profile development by the Cape. Two minutes after the balloon release of 
the Jimsphere, a single “shadow” High-Resolution balloon is released and data is processed on two separate 
computers. If there is a problem with the Jimsphere data not meeting Space Shuttle requirements then the High- 
Resolution data is utilized. 

There exists a possibility of a weather balloon and Space Shuttle collision since balloons may enter the air space 
the Space Shuttle will occupy during flight. To enact balloon collision avoidance (COLA) mitigation, balloon 
groundtrack traces are plotted and compared to the Space Shuttle’s groundtrack. Should there be an elevated 
concern, the balloon release time schedule will be modified to reduce the risk. 
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Figure 4. Balloon COLA 

STS-128 on 8/24/09: L-9:00 Low-Resolution balloon 
(red) with Space Shuttle trajectory (green). 


VII. Day-of-Launch Timeline 

The essential DOL1LU process is to receive balloon data, design a trajectory, and verify that trajectory. This 
process is repeated throughout the launch count. The exception is that at some point, the design is frozen, but the 
trajectory is continually verified with up-to-date balloon data. 

Low-Resolution balloons are released for atmospheric data and other customers of balloon data on DOL. All 
times are given in terms of Launch minus hours and minutes, or L-HH:MM. Low-Resolution balloons that 
DOLILU uses for atmospheric data are released at L-9:00, L-6:20, L-3:45, and L-0:30. For wind data, balloon 
release times are: L-6: 15, L-4:50, L-3:35, L-2:20, L-l:25, L-l:08, L-0:50, and one post-flight at L+0:15. The final 
DOLILU Go/No-go is given by the LDO at L-0:30. While the DOLILU process is basically repeated, each balloon 
assessment has different purposes as Table 1 shows. 


5 

American Institute of Aeronautics and Astronautics 


Table 1. DOLILU Balloon Purposes 


Balloon 

Release 

Time 

Purpose 

L-6: 1 5 

Balloon consists of design, High-Q verification, and roll maneuver verification. This 
balloon is a final system check-out balloon and is the first of trending data for the day. 
Balloon also serves as a second backup to the designed 1-Loads should they have to 
be used. 

L-4:50 

Balloon consists of the prime design, High-Q verification, and roll maneuver 
verification. This is the planned time to design the trajectory I-Loads. 

L-3:35 

Balloon consists of High-Q verification and roll maneuver verification. This balloon 
is the backup design balloon to the L-4:50 and the backup to the prime High-Q 
verification balloon at L-2:20. The L-3 :35 balloon is assessed with 3 hours of wind 
persistence. 

L-2:20 

Balloon consists of the prime High-Q verification. This balloon is assessed with 2 
hour wind persistence. 

L- 1 :25 

Balloon is a contingency High-Q verification balloon. Should certain conditions 
exist, this balloon will be the prime High-Q verification. 

L-l:08 

Balloon is the prime roll maneuver verification. 

L-0:50 

Balloon is the backup roll maneuver verification. 

L+0:15 

Balloon is used for post- flight trajectory analysis. 


Table 2. DOLILU Balloon Schedule 
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VIII. Trajectory Design 


DOLILU designs the pitch, yaw, and throttle commands for the Space Shuttle. The DOLILU design targets an 
optimal angle-of-attack (Alpha) schedule to negative four degrees which reduces wing loading during ascent, targets 
angle-of-sideslip (Beta) to zero degrees to reduce side loads, and recalculates the throttle command to keep the 
maximum dynamic pressure (Qbar) near a design target. Since potential wind variations are greater in the winter 
than in the summer, the Qbar target is reduced for a winter launch. Angle-of-attack and sideslip targets are not 
updated for a winter launch. DOLILU rebalances the steering and throttle command tables through two steps. 

The first step uses an iterative three degree-of- freedom computer simulation that results in a first cut at the pitch 
and yaw I-Loads and the final throttle commands tables. The SSMEs throttle down to reduce Qbar and structural 
loads and throttle back up after passing through the point of peak dynamic pressure. The wind profile used for this 
first step is filtered, or smoothed, using a four pass Martin-Graham low pass filter. This, approximately 15,000 ft 
filter, removes wind features which are not considered to be persistent between the design wind measurement and 
the actual launch. 

The first pass also determines the on-board wind table. This is an eight point table represented by north and east 
components of the wind. The wind points from the surface to 70,000 ft are used to approximate the wind velocity 
and therefore mach. Given this knowledge of the wind onboard, certain vehicle I-Loads were standardized such as 
the Space Shuttle elevon schedule that is used to reduce elevon hinge moment loading during flight. 

The second step uses a higher fidelity simulation program that includes 6-DOF effects. This simulation utilizes 
the unfiltered measured wind to fine-tune the pitch and yaw I-Loads by centering the trajectory on the induced 
Alpha and Beta spikes. The resultant pitch and yaw I-Load tables are referenced to thirty specific velocities. 

The designed trajectory is optimized for a specific wind, but has been demonstrated to be valid for the actual 
launch wind. In operations, the nominal design balloon is released at L-4:50, with the first backup at L-3:35, and the 
second backup at L-6: 15. The I-Load balloon is chosen based on visual comparison from the L-4:50 balloon to the 
forecast balloon. Should a large amount of change be observed or predicted, the timeline will support a delay the 
design of I-loads until the L-3:35 balloon. The updated I-Load tables are uplinked to the Orbiter on the launch pad 
at roughly ninety minutes before launch. Constraint assessments are required to made using later balloon 
measurement in order to account for wind changes which may adversely impact vehicle constraints. 


IX. Structural Load Indicator Constraints 

The integrated Space Shuttle vehicle is made up of one External Tank (ET), two Solid Rocket Boosters (SRB), 
and the Space Shuttle Orbiter itself. Airloads and throttle-sensitive structural loads certification constraints are 
evaluated on DOL to verify that the predicted trajectory is within certification. Given the short time to assess 
constraints and the risk with complex algorithms, simplified structural load indicators (SLI) were developed from 
higher fidelity structural analytical limits to determine element structural loadings given a newly designed trajectory 
on DOL. Forty-two SLI protect specific points on the integrated vehicle such as Shuttle to ET attach loads. 

SLI are evaluated in the High-Q region of flight which is defined from mach 0.6 to 2.2. This region will contain 
the ramp up to the maximum Qbar in flight and then the beginning of the ramp down. Trajectory data is fed to a 
post-processor to determine the defined SLI for evaluation. The limit for each SLI is different and can vary across 
the evaluated mach region. Each SLI load from the post-processor is then further dispersed closer to the ultimate 
limit with unmeasured effects. Wind persistence, system dispersions, and gust dispersions are combined using a 
root sum squared method. This total dispersion is then added to the undispersed value, and compared to the limit. 
The difference is margin. If the minimum margin over the mach region is positive, then the SLI is Go. Should the 
margin be negative, the SLI is No-go. If the last balloon assessment for the SLI is No-go, then DOLILU will be No- 
go for that launch attempt. 
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X. Q-Plane Constraints 


Integrated vehicle airloads certification limits are protected by evaluating a simplified constraint that compares 
the predicated trajectory’s resultant Alpha, Beta, Qbar, at varying Mach numbers to a pre-verified “Q-plane” or 
“Squatchaloid” constraint. This four dimensional space uses Mach as the independent variable, where there exists a 
three dimensional space with Alpha and Beta on the horizontal plane and Qbar in the vertical. Therefore, at a Mach, 
there can exist a frustum or cylinder shaped limit. With this limit, Qbar can be traded for Alpha and Beta. That is, 
the vehicle can withstand larger Alpha and Beta variation from the optimal if the vehicle experiences a lower Qbar. 
Figure 5 shows a Q-plane at a given Mach and Qbar. For every Mach, if the Alpha, Beta, Qbar point is determined 
to be inside the frustum, then the constraint is Go. 

Elements of the Space Shuttle integrated vehicle are then able to define a safe region of flight that is simple to 
evaluate on DOL. Four separate Q-Plane constraints are assessed on launch day. Each protects a specific 
certification limit or operational constraint. 


• The Orbiter Q-planes protect the orbiter structural load redlines. 

• The ET Protuberance Zero Margin Squatchaloid protects External Tank structural limits which are 

primarily driven by ET protuberances. 

• The Performance Enhancement DOL1LU II Verification Space protects certification limits assessed 

during validation of the DOLILU process. The boundary conditions which this limit protects were 
evaluated and cleared during certification of the DOLILU process. 

• The Roll Maneuver Q-plane protects the integrated vehicle during the roll maneuver to the flight heading 

which is initiated after the Shuttle clears the launch tower. This limit was put in place after the loss of 
Columbia. In the detailed reconstruction of this mishap, it was discovered that the certified SRB aft 
strut loads were almost exceeded during this maneuver. Certification loads in this region were derived 
from flight experience and analysis. A Q-Plane constraint was derived which was intended to verify 
that the day-of-launch prediction was within certification in the region from Mach 0.25 to 0.5. 


For each of the Q-planes, similar to the SLI, 
there is a statistical dispersion for unmeasured 
effects. Wind persistence, system dispersions, 
atmosphere persistence, gust, and engine-out 
effects are accounted for in the assessment of the 
Q-planes. Wind persistence, system dispersions, 
and atmosphere persistence are root-sum- 
squared. This dispersion is then added to the 
measured trajectory data. The limits themselves 
are reduced for the engine-out and gust effects. 
Should the margin from the dispersed trajectory 
point to the reduced limit be positive, then the 
constraint is Go, otherwise No-go. 
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XI. Trajectory Parameter Constraints 


DOLILU certification constraints are assessed by verifying that the launch day prediction is within the DOLILU 
trajectory certification envelope. These rules are grouped into sub-classes based on their developmental heritage and 
their criticality. “Experience” or “E” rules represent the limit of certification and not necessarily the limit of 
capability. E Rules include: attitude errors, angular accelerations, SSME and SRB thrust vector steering 
commanded positions, Orbiter elevon hinge moments, the pitch and yaw steering tables, and the updated on-board 
wind table. Each parameter is compared to the experience database used in vehicle certification of the expected 
envelope of trajectories and the minimum is reported. Should this minimum be negative, then the rule is broken. If 
there is good rationale to explain why it is safe to fly, then an “Exception” to the E rule can be enacted with proper 
approval. 

“System” rules, also called “S” rules, are hard constraints used to verify the vehicle’s staging limits, vehicle 
pitch/yaw/roll rates, Range Safety limits, and throttle limits. These rules are quantified in the same manner as the E 
Rules. “Processor Integrity” or “P” rules are similar to S Rules and used to ensure computer simulations compare 
well and converge to solutions. S rules and P rules require a higher level of approval should the rule have good 
rationale to “Waive” the rule. All trajectory rules have been reduced to account for wind persistence and system 
dispersions on the evaluated rule. 


XII. Wind Persistence Dispersion 

The DOLILU system will give the final trajectory assessment based on balloon data released 2 hours and 20 
minutes before launch. This is the final Go/No-go placard due to the 65 minute balloon rise, computer processing 
time, quality assurance, and reporting time. Therefore, the final DOLILU assessment does not truly assess the real 
wind that the Space Shuttle will experience. The wind from the surface to 60,000 ft will continue to change through 
the launch time and the impact on any actual constraint may not be completely understood without a full assessment. 
“Wind persistence” is the term given to define this lack of temporal persistence on the vehicle constraints due to the 
changing wind. 

Both the SL1 and Q-plane constraints utilize a “Minimum Margin” statistical method 2 . Margin is defined as the 
distance from a parameter to its limit. Minimum margin then represents the closest margin over a range of values. 
Should the parameter exceed the limit, the minimum margin would then represent the largest violation of the limit. 
This methodology offers the advantages of protecting the actual limits and is insensitive to wind features shifting in 
altitude. Minimum margin determines the protection required for a parameter to not exceed the constraint 99% of 
the time at any point in the evaluated region. 

To develop the wind persistence dispersion, the Space Shuttle Program utilized a database of measured wind 
profiles released from the launch site at fixed intervals. Wind profiles measured both about 2 and 3 U hours apart 
were cataloged and totaled 1000 wind profile pairs. Seasonal differences exist in upper atmospheric winds, 
therefore, the database is further split into seasons and analyzed independently. For the first of the wind pair, a 
trajectory design was generated, the trajectory was flown, and the Q-plane’ s Alpha, Beta minimum margin was 
determined. For the second of the pair, the design was from the first wind was flown through using the second wind 
and the Q-Plane Alpha, Beta Minimum Margin was determined. 

Using this minimum margin data, the mean and standard deviation of the first of the pairs and of the second of 
the pairs can be computed. Additionally, the correlation coefficient between each can be computed. This data will 
be used in a bivariate conditional Gumbel probability distribution. 

Only two dispersion increments were developed: 2 hour and 3 Vi hour. Therefore, inside of 2 hours to launch, the 
2 hour increment is utilized. Should the contingent L-l:25 hour assessment be required, the result might be slightly 
conservative. However, closer to launch, there exist other means to protect the DOLILU design with wind-only 
assessments. 
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XIII. Wind-Only Assessments 


DOLILU consists of the Prime Team at JSC, the IV&V Team at a contractor facility, and the MSFC 
Environments Team who specialize in meteorological data and were responsible for several DOL critical functions 
listed below 3 . 

• Wind profile reasonableness qualitative assessment of the Cape’s wind profile is completed by 

comparison to other measurement systems. 

• Wind shear quantitative assessment measures each wind profile maximum out-of-plane wind shear at 

various altitude intervals. This check ensures that the DOL wind’s shear was inside of vehicle 
certification of the vertical tail. 

• Large scale wind change qualitative assessment is an intentionally vague rule to stop a launch should 

upper level wind conditions substantially change such that the DOLILU assessment no longer is valid. 
In practice, this rule was never enacted for any Space Shuttle launch. 

• Wind change redline 4 quantitative assessment is a rule to complete a conservative approximation to a true 

trajectory assessment. This rule was developed after the Columbia accident. Primarily used from one 
hour to 15 minutes of launch, this rule is best used when there is not enough time to complete trajectory 
assessment of a balloon. This rule differences the filtered design wind to a current filtered wind - often 
a 50 MHz DRWP wind profile. This delta is then compared to a redline. Should the difference exceed 
the redline for an amount greater than the tolerance, the Space Shuttle would be considered No-go. 


XIV. Independent Verification and Validation 

While the Prime Team designs and verifies the design, the IV&V Team specializes in verification. For the 
Space Shuttle Program, the IV&V Team is contracted under the development contractor who maintains 
independence by a separate management chain and separate facilities. This team not only participates in DOL 
assessments, but is heavily involved in every DOLILU process decision through a common long-standing working 
group. The IV&V organization is assigned to the NASA Systems Integration and Engineering organization while 
the Prime Team is operated by the NASA Mission Operations Directorate. This difference at many levels affords 
good autonomy with good collaboration between systems integration and operations organizations. 

Between the IV&V and Prime Teams, software tools are independently coded to the same requirements. 
Software configuration management and internal procedures are implemented differently, but designed to the same 
standards. This independence is continued to launch day, where the IV&V Team independently receives the wind 
profile data from the Cape. In order for DOLILU to be Go, constraint margins between the Prime and IV&V Teams 
must compare to within defined tolerances. 


XV. Vehicle Certification and Launch Probability 

Significant prelaunch work by the Prime and IV&V organizations is done to certify the DOLILU system for 
flight. While DOLILU reduces the trajectory variation given different atmospheric conditions, the expected 
variation is important to certify the vehicle’s flight envelope. A large set of trajectories is routinely run to offer 
subsystems a trajectory baseline for certification and impact changes to the DOLILU process or constraints. This 
process is termed, launch probability. 

Launch probability is a quasi-Monte Carlo process where various winds and atmospheric data are entered into 
the DOLILU design and assessment process to report a Go percentage. A database of 150 measured Jimsphere 
balloons for each month is combined with monthly measured atmosphere data. DOLILU then uses each wind and 
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atmosphere for design and constraint assessment. This results in 150 Go or No-go placards. Thus, the percent Go is 
probability of launch. 

Baseline DOLILU launch probability demonstrates a minimum of 90% in February, and near 100% for July. 
When considering a change to the DOLILU process, design or inputs, the impact to launch probability is quantified. 
For example, should the wind persistence dispersion need to increase, the resultant launch probability can be 
delivered to show the impact. 

DOLILU has significantly improved launch probability over other design methodologies. If DOLILU did not 
exist, and a mean wind design was utilized for the Space Shuttle, the launch probability for February would be 
reduced from about 90% to about 30%. This is the effectiveness of DOLILU. DOLILU re-centers and reduces the 
vehicle loads, while normalizing ascent performance. 


XVI. Ascent Performance Margin 

The Space Shuttle aims to have more propellant at MECO than is required, thus reducing the risk of not meeting 
mission objectives. Excess propellant at MECO is termed performance margin and is calculated in terms of pound 
mass. This performance could have been used to bring more payload to orbit. 

Flight Performance Reserve (FPR) is a statistical dispersion for in-flight performance deviations added to the 
required amount of propellant to ensure a guided MECO. Ascent Performance Margin (APM) is performance above 
FPR and above other unusable propellants remaining at MECO. APM is managed pre-launch for manifesting 
purposes and on day of launch for launch window length determination. 

Flight Performance Reserve is developed to compensate for higher than nominal propellant consumption. These 
approximately 3000 lbs represented a three-sigma likelihood that the vehicle will not run out of Liquid Oxygen 
(LOX) or Liquid Hydrogen (LH2). Due to the engine mixture ratios, it is beneficial to bias the LH2 heavy. This 
“fuel bias” is approximately 1000 lbs. 

In the months and years before each flight, the Space Shuttle Program needs to understand the variation of APM. 
APM is used to cover the impacts of the variations in SRB propellant temperatures, variations in SRB burn rates, 
monthly variations in wind and atmosphere, monthly variation in performance, variations in DOL propellant 
loading, expected variations in vehicle element weights including payload throughout the mission planning 
timeframe, and a desired launch window length. 

Average APM varies throughout the year and is primarily influenced by SRB propellant mean bulk temperature 
(PMBT) and average atmospheric conditions for each month. Average monthly wind, atmosphere, and PMBT 
combine to vary APM by 1000 lbs from a low in February to the best performing month of October. 

In addition to the monthly variation in APM, certain effects are not known until launch day. The Space Shuttle 
Program seeks to maintain a total of 900 lbs of vehicle performance for these uncertainties: actual DOL wind and 
atmosphere, launch minus three day PMBT changes, and actual Liquid Oxygen (LOX) and Liquid Hydrogen (LH2) 
loading. 

This propellant load is calculated on DOL using estimated LOX and LH2 density derived from measured LOX 
and LH2 ullage pressures. The LH2 actual propellant load is fairly constant, however the LOX load densities over 
time. While maintaining the LOX liquid level for approximately six hours and 30 minutes, the LOX mass tends to 
effectively increase by 0.3% of the total load. 

The Space Shuttle Program plans a five minute launch window for International Space Station (ISS) missions. 
This is centered at an in-plane launch and two minutes 30 seconds on either side. An in-plane launch time has the 
most APM where the vehicle does not have to complete out-of-plane steering. The APM cost to allow a five minute 
window is about 600 lbs. 
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The performance dispersions can be totaled: 


FPR (3000) + Fuel Bias (1000) + DOL Dispersions (900) + Launch Window (600) = 5500 lbs 

The Space Shuttle is reasonably assured of launching with positive APM and not running out of performance 
before MECO. With the APM variation given launch day conditions, accurate launch times are communicated to 
others in Mission Control responsible for close-to-launch holds. 


XVII. DOLILU Uplink 

Following a validated DOLILU design, the I-Loads are uplinked to the Space Shuttle vehicle. The Prime Team 
at JSC is responsible for delivering the I-Loads to the MCC’s Guidance Procedure Officer (GPO). These I-Loads 
are combined with other recently modified I-Loads for both the nominal mission and aborts from a delivery at 
launch minus 15 days. This combined package is uplinked to the vehicle. Data integrity is verified by dumping the 
actual Space Shuttle General Purpose Computer’s (GPC) memory. This memory dump is then down linked and 
compared, by the GPOs, to the original I-Loads. The entire uplink process and quality assurance takes about 30 
minutes. The DOLILU IV&V Team does not receive a down link of the I-Loads. 

This uplink must be accomplished in a vehicle computer mode capable of receiving such data which ends at 
about launch minus one hour. The DOLILU process is configured to only uplink one set of I-Loads per launch 
attempt, and does not support the substitution of later “better” I-Loads. The DOLILU uplink is one of only a handful 
of critical prelaunch uplinks of key GNC parameters on the day-of-launch. 


XVIII. Conclusion 

The DOLILU process is critical to the safety of the vehicle. The Space Shuttle DOLILU system represents a 
well evolved method which may be used as a template for future launch vehicle systems. The Space Shuttle’s Day- 
of-Launch Initialization Load Update system is successful in achieving the goals of maintaining safety, reducing 
vehicle structural loads, and improving launch availability. 
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Nomenclature 


6-DOF 

= Six Degree-Of-Freedom 

Alpha 

= Angle-of-Attack 

AMPS 

= Automated Meteorological Profiling System 

APM 

= Ascent Performance Margin 

Beta 

= Angle-of-Sideslip 

Cape 

= Cape Canaveral Air Force Base 

COLA 

= Collision Avoidance 

DOL 

= Day-Of-Launch 

DOLILU 

= Day-of-Launch Initialization Load Update 

DRWP 

= 50 MHz Doppler Radar Wind Profiler 

ET 

= External Tank 
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ft 

= 

Feet 

FPR 

= 

Flight Performance Reserve 

GPC 

= 

General Purpose Computer 

GPO 

= 

Guidance Procedure Officer 

GPS 

= 

Global Positioning System 

I-Load 

= 

Initialization Load 

ISS 

= 

International Space Station 

IV&V 

= 

Independent Verification and Validation 

JSC 

= 

Johnson Space Center 

LDO 

= 

Loads and DOLILU Officer 

LH2 

= 

Liquid Hydrogen 

LOX 

= 

Liquid Oxygen 

MCC 

= 

Mission Control Center 

MECO 

= 

Main Engine Cut-Off 

MMT 

= 

Mission Management Team 

MOD 

= 

Mission Operations Directorate 

MSFC 

= 

Marshall Space Flight Center 

NASA 

= 

National Aeronautics Space Administration 

PMBT 

= 

[SRB] Propellant Mean Bulk Temperature 

QA 

= 

Quality Assurance 

Qbar 

= 

Dynamic Pressure 

SAR 

= 

Single Axis Rotation 

SLI 

= 

Structural Load Indicator 

SRB 

= 

Solid Rocket Booster 

SSME 

= 

Space Shuttle Main Engines 
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DOLILU is the process by which the space shuttle’s 
trajectory is designed, verified, and uplinked, and 
which does the following: 

• Maintains safety of crew and vehicle 

• Reduces vehicle loads 

• Improves launch availability 


l-Load Design 


For the Initialization Load Design, DOLILU targets an optimal alpha of -4° to protect wing loads, and a Beta 
to 0°, and recalculates the throttle commands to keep Qbar near a design target. For balloon 
assessments after the 1-Loads are designed, the trajectory may become less optimal. Constraint 
assessments must be made using later balloons to account for subsequent wind changes. 


Balloon Schedule 


Balloons are released starting 
at 6 hours 15 minutes before 
launch. After 1 hour of rise 
time, the balloons are 
transmitted to the three 
DOLILU organizations. The 
DOLILU parameters are uplinked 
to the space shuttle by L - 1:30. 
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DOLILU Overview 


Five Constraint Types: 

Q-Planes 

Trajectory Parameter Rules 
Structural Load Indicators 
Wind-only 

Compares from Prime to IV&V Teams 


Natural Environments 


Cape Winds 


Weather instrumentation near the launch site is critical for DOLILU operations. 

• Jimsphere Radar tracked balloons measure wind data 

• Low-Resolution Automated Meteorological Profiling System (AMPS) balloons measure 
thermodynamic data 

• 50 MHz Doppler Radar Wind Profiler (DRWP) measures wind data 

• Upper Winds Forecasts predict wind data 
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Launch Wind Forecast 
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Balloon COLA 

Should weather balloons (red) 
appear to enter the same 
airspace as the space shuttle’s 
trajectory (green), then Collision 
Avoidance (COLA) procedures are 
enacted to reduce the likelihood 
of a collision. 
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GO/NO-GO Launch 
Recommendation 


to Prime 


The space shuttle's trajectory must be contained inside a 
“Q-plane” flight envelope during the high-Qbar and roll 
maneuver regions to ensure that vehicle air loads are not 
exceeded. At a given Mach from 0.25 to 2.2, the 
trajectory's Alpha, Beta, and Qbar must be contained in a 
3-dimensional conical frustum. This can be simplified 
further to an Alpha and Beta plane, or a Beta and Qbar 
side view. The distance from the dispersed trajectory 
point to the constraint is called margin. 



To Mission 
Management 
Team (MMT) 

The DOLILU team consists of three primary organizations with various supporting groups. The central flow on 
day-of-launch is for wind data to flow from the Cape to the Prime Team at Johnson Space Center, to the 
Independent Verification and Validation (IV&V) Team at a contractor-managed remote location, and to natural 
environments experts at Marshall Space Flight Center (MSFC). The Loads and DOLILU Officer (LDO) on the Prime 
Team has the overall responsibility of DOLILU for a given launch. 
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Ascent Performance Margin is remaining propellant in excess of that required to reach 
orbit. Launch day performance uncertainties influence pre-launch payload manifesting. 
Launch day performance variations impact launch window calculations. 


Launch Probability Wind Persistence 



A quasi-Monte Carlo approach is used to simulate the 
launch day DOLILU environment by evaluating the 
Go/No-Go percentage given various winds and 
atmospheres. This process is used to certify various 
flight configurations and evaluate changes to the 
DOLILU process. DOLILU is shown to dramatically 
improve launch probability over mean wind designs. 



Because the wind will continue to change after the last 
assessment at L-2:20 to launch time, a generic dispersion must 
account for the resultant change in constraint margin. The wind 
persistence dispersion is developed in a manner imitating the 
launch day process. Wind A is designed and assessed, followed 
by wind B, which is only assessed. Each trajectory constraint's 
minimum margin is then utilized to derive the dispersion. 
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